CVE-2026-93282

Received Received - Intake

ksmbd DACL Access Control Bypass Vulnerability

Publication date: 2026-09-24

Last updated on: 2026-09-25

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix maximum allowed access checks The DACL permission check looks for an ACE matching the current user and falls back to the Everyone ACE. It does not consider an Authenticated Users ACE, even though an authenticated session is a member of that well-known group. As a result, opening a file whose access is granted through S-1-5-11 can incorrectly fail with STATUS_ACCESS_DENIED. Treat an Authenticated Users ACE as a fallback entry alongside Everyone. The maximal access calculation also combines access masks from every ACE, regardless of whether its SID applies to the current user. This can grant rights belonging to an unrelated principal. Process only ACEs applying to the user, Everyone, or Authenticated Users, and accumulate allowed and denied masks in ACL order. Preserve explicitly requested access bits so they are validated against the resulting maximal mask. When ACCESS_SYSTEM_SECURITY is denied, report STATUS_PRIVILEGE_NOT_HELD instead of the generic STATUS_ACCESS_DENIED. Access to the system ACL requires a security privilege that ksmbd does not grant. For regular files, include FILE_EXECUTE in maximal access when the client requested GENERIC_EXECUTE and the DACL grants the complete file-read set. Keep a direct FILE_EXECUTE request subject to the explicit DACL bit. This matches the POSIX file ACL mapping without broadening specific execute requests. Do not replace rights from an applicable NT ACE with a POSIX ACL entry. The POSIX ACL is only a fallback when no user, Everyone, or Authenticated Users ACE applies; otherwise it can incorrectly broaden the stored DACL. This fixes smb2.maximum_allowed.maximum_allowed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-24

Last Modified

2026-09-25

Generated

2026-09-25

AI Q&A

2026-09-24

EPSS Evaluated

N/A

NVD

CVE-2026-93282

EUVD

EUVD-2026-86154

Affected Vendors & Products

Vendor	Product	Version / Range
linux_kernel	ksmbd	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel's ksmbd (SMB server) involves incorrect access control checks. The system fails to properly recognize the Authenticated Users group when verifying file permissions, leading to incorrect access denials for files that should be accessible. Additionally, it may grant excessive rights by combining access masks from unrelated security identifiers.

Detection Guidance

This vulnerability is specific to the ksmbd module in the Linux kernel and relates to DACL permission checks. Detection would require checking kernel logs for SMB-related access denied errors or verifying if ksmbd is handling file access incorrectly. Commands like 'dmesg | grep ksmbd' or 'journalctl -u smb --no-pager' may help identify issues.

Impact Analysis

Users may be unable to access files they are authorized to view or modify due to incorrect permission checks. Systems relying on ksmbd for SMB file sharing could experience access errors or privilege escalations, potentially disrupting operations or allowing unauthorized access to sensitive data.

Compliance Impact

This vulnerability could lead to unauthorized access or denial of access to sensitive data, violating confidentiality and availability requirements in GDPR and HIPAA. Non-compliance risks include data breaches, improper access controls, and failure to meet regulatory audit standards.

Mitigation Strategies

Update your Linux kernel to the latest patched version to resolve the ksmbd DACL permission check issue. If ksmbd is not in use, consider disabling it via 'modprobe -r ksmbd' or blacklisting it. Monitor SMB access logs for STATUS_ACCESS_DENIED errors post-update.

Hi! I’m here to help you understand CVE-2026-93282. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70